signed commits and tags about magento-lts HOT 6 CLOSED

Signing tags makes sense since they are a point-in-time representation of a set of changes. Signing everything doesn't make as much sense. Since you can't tag via GitHub (AFAIK?) there's no downside to enforcing this as policy when releasing new tags.

from magento-lts.

How is this enforced? Also how does this work with github's web-based "Merge" button?

from magento-lts.

There is no enforcement (yet)
In a far distant future tools like composer could check if a tag was signed and are able to deny install for unsigned ones.

as the web ui just adds a merge commit, it does not interfere if the commits inside this PR are signed.

For Tags, we could also sign the downloads, this would be a manual process which is I think currently useless, as for example composer would not make use of it

from magento-lts.

Generally I'm the one doing tagging, so please help me remember to do this next time we create a release and I'll tag it. Is it possible to sign old tags somehow @Flyingmana ?

from magento-lts.

Can we add tis to the readme? Or is there a better place? and close the issue

from magento-lts.

Can we add tis to the readme? Or is there a better place? and close the issue

This is something cor contribution guidelines .... working on it.

from magento-lts.